cyberchef_entropy_scan
Locates high-entropy regions in files, reports offsets, and uses chi-squared and serial correlation to distinguish compressed from encrypted data.
Instructions
Find WHERE a file's entropy is high, not just whether it is: contiguous regions above a threshold, with offsets. CyberChef's Entropy curve has a fixed 256-byte bin, no threshold and no region output. Applies Lyda and Hamrock's packed-binary rule (a CONJUNCTION of mean > 6.677 and peak > 7.199, not the single 7.0 usually quoted) and adds chi-squared and serial correlation as a second axis, which is what separates compressed from encrypted. Reports what a high number does and does not establish.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| input | Yes | The data. | |
| threshold | No | Bits per byte above which a window counts as high-entropy. 7.0 is conventional and weak; the report says why. | |
| step_bytes | No | Distance between windows. Defaults to the window size, i.e. no overlap. | |
| max_regions | No | How many regions to return. | |
| input_format | No | How `input` is encoded. | Raw |
| window_bytes | No | Window size for the sliding scan. 256 is the sourced figure; a larger window hides encryption that exists only in small areas. |